Customized file systems: an investigator's approach
Author: 
Marc ParisiAuthors Info & Claims
Marc ParisiAuthors Info & ClaimsPages 13 - 17
Abstract
With the growth of many open source operating systems comes the introduction of open source file systems that allow free modification. File system modifications can be a method of users to evade investigators who use commercial tools to analyze the suspect's media. Investigators need to be aware of what is possible and ways to circumvent the methods that users can utilize when modifying their file system to hide data.
References
[1]
Brian Carrier, File System Forensic Analsys, Addison-Wesley, 2005, pp. 47--51.
[2]
Brian Carrier, File System Forensic Analsys, Addison-Wesley, 2005, p. 81.
[3]
Brian Carrier, File System Forensic Analsys, Addison-Wesley, 2005, p. 137.
[4]
Brian Carrier, File System Forensic Analsys, Addison-Wesley, 2005, pp. 397--447, pp. 509--536.
[5]
C. P. Wright, M. C. Martino, and E. Zadok, "NCryptfs: A Secure and Convenient Cryptographic File System," Usenix.org, https://www.usenix.org/events/usenix03/tech/full_papers/wright/wright_html.
[6]
E. Zadok, I. Badulescu, and A. Shender "Cryptfs: A Stackable Vnode Level Encryption File System," Columbuia University, http://www1.cs.columbia.edu/~library/TR-repository/reports/reports-1998/cucs-021-98.pdf.
[7]
K. J. Jones, R. Bejtlich, and C. W. Rose, Real Digital Forensics: Computer Security and Incident Response, Addison-Wesley, 2006, P 3--4.
[8]
I. Dubrawsky, "Cryptographic Filesystems, Part One: Design and Implementation," Security Focus; March-2007; http://www.securityfocus.com/infocus/1673.
[9]
M. Blaze, "A Cryptographic File System for Unix," Proc. 1st ACM Conference on Computer and Communications Security, Fairfax, VA, November-1993.
[10]
M. W. Marcellin, A. Bilgin, M. J. Gormish, and M. P. Boliek, "An Overview of JPEG-2000," Data Compression Conference (DCC '00), p. 523 2000
[11]
The grugq, "The Art of Defiling: Defeating Forensic Analysis on Unix File Systems," Blackhat.com; http://www.blackhat.com/presentations/bh-asia-03/bh-asia-03-grugq/bh-asia-03-grugq.pdf.
[12]
Wikipedia Contributors, "Ext3," http://en.wikipedia.org/wiki/Ext3 (current November 01, 2007).
[13]
Wikipedia Contributors, "Hash Function," http://en.wikipedia.org/wiki/Hash_function (current November 01, 2007).
[14]
W. Stallings, Operating Systems: Internals and Design Principles. Pearson Education, 2005, p. 93
[15]
W. Stallings, Operating Systems: Internals and Design Principles. Pearson Education, 2005, p. 153
Index Terms
- Customized file systems: an investigator's approach
Recommendations
UCFS-A Novel User-Space, High Performance, Customized File System for Web Proxy Servers
Web proxy caching servers play a key role in today's Web infrastructure. Previous studies have shown that disk I/O is one of the major performance bottlenecks of proxy servers. Most conventional file systems do not work well for proxy server workloads ...
A multiple-file write scheme for improving write performance of small files in Fast File System
Fast File System (FFS) stores files to disk in separate disk writes, each of which incurs a disk positioning (seek + rotation) limiting the write performance for small files. We propose a new scheme called co-writing to accelerate small file writes in ...
Serverless network file systems
Special issue on operating system principlesWe propose a new paradigm for network file system design: serverless network file systems. While traditional network file systems rely on a central server machine, a serverless system utilizes workstations cooperating as peers to provide all file system ...
Comments
Information & Contributors
Information
Published In
March 2008
548 pages
ISBN:9781605581057
DOI:10.1145/1593105
Copyright © 2008 ACM.
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]
Publisher
Association for Computing Machinery
New York, NY, United States
Publication History
Published: 28 March 2008
Check for updates
Qualifiers
- Research-article
Conference
ACM SE08
Acceptance Rates
Overall Acceptance Rate 502 of 1,023 submissions, 49%
Contributors
Other Metrics
Bibliometrics & Citations
Bibliometrics
Article Metrics
- 0Total Citations
- 166Total Downloads
- Downloads (Last 12 months)0
- Downloads (Last 6 weeks)0
Reflects downloads up to 23 Jan 2025
Other Metrics
Citations
View Options
Login options
Check if you have access through your login credentials or your institution to get full access on this article.
Sign in